CVE-2011-1091 — NULL Pointer Dereference in Pidgin

CWE-476 — NULL Pointer Dereference8 documents7 sources
Severity
4.0MEDIUMNVD
EPSS
1.5%
top 18.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PidginDebian Pidgin
Timeline
PublishedMar 14
Latest updateMay 17

Description

libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 8.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/pidgin< pidgin 2.7.11-1 (bookworm)
▶Debianpidgin/pidgin< 2.7.11-1+3
▶NVDpidgin/pidgin17 versions+16

Patches

Patch: developer.pidgin.im ↗Patch: developer.pidgin.im ↗Patch: www.pidgin.im ↗

🔴Vulnerability Details

2
GHSA
GHSA-784h-wwvm-3rvx: libymsg↗2022-05-17
▶
OSV
CVE-2011-1091: libymsg↗2011-03-14
▶

📋Vendor Advisories

3
Ubuntu
Pidgin vulnerabilities↗2011-11-21
▶
Red Hat
Pidgin: Multiple NULL pointer dereference flaws in Yahoo protocol plug-in↗2011-03-10
▶
Debian
CVE-2011-1091: pidgin - libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-1091 Pidgin: Multiple NULL pointer dereference flaws in Yahoo protocol plug-in [fedora-all]↗2011-03-11
▶
Bugzilla
CVE-2011-1091 Pidgin: Multiple NULL pointer dereference flaws in Yahoo protocol plug-in↗2011-03-08
▶